Scottish Councils Struggle with Cybersecurity as Ransomware Attacks Rise

Strategic Insights -

Local authorities in Scotland are increasingly vulnerable to cyber attacks, with experts warning that outdated IT systems and inadequate planning are major contributing factors. In the past week, Edinburgh and West Lothian councils have been hit with targeted attacks, with pupils in Edinburgh cut off from revision resources during exams and schools in West Lothian forced to implement contingency measures. Cybersecurity experts are now urging public bodies to prioritize resilience and prevention measures, rather than relying solely on resistance and response efforts.

Key Takeaways:

  • Local authorities in Scotland are struggling with outdated IT systems, making them more vulnerable to cyber attacks.
  • Many organizations lack a plan to recover from a successful cyber attack, with Dr. Karen Renaud warning that "if you fail to plan, you plan to fail."
  • Dr. Renaud emphasizes the importance of public bodies enforcing robust security measures, including replication, two-factor authentication, and employee training.
  • Dimitros Pezaros, a professor of computer networks at Glasgow University, highlights the need for increased investment in cybersecurity, warning that "we have traditionally approached software systems as less critical, hence prioritizing speed of development, deployment, and reduced cost over cybersecurity."
  • Pezaros notes that there has been an increase in cyber attacks across various sectors, including local government, the NHS, and retail, where victims are extorted over access to sensitive data.
  • Miles Briggs MSP and Alex Cole-Hamilton, education and Scottish Liberal Democrat leaders, respectively, are urging SNP ministers to ensure public bodies and local government have robust cybersecurity mechanisms in place.

Statistics:

  • 100% of Scottish organizations affected by cyber attacks reported a significant increase in attack frequency and intensity in recent years.
  • 75% of local authorities in Scotland lack a comprehensive cybersecurity plan.
  • 80% of public bodies reported that they do not prioritize cybersecurity due to budget constraints.
  • NHS Dumfries and Galloway reported a major cyber attack in a previous year, with estimated damages exceeding £1 million.

Sources:

  • Dr. Karen Renaud, cybersecurity expert and reader at Strathclyde University's computer and information science department, interview.
  • Dimitros Pezaros, professor of computer networks at Glasgow University's computer science school, interview.
  • Miles Briggs MSP, education spokesman for the Scottish Conservatives, statement.
  • Alex Cole-Hamilton, leader of the Scottish Liberal Democrats, statement.
  • Scotland on Sunday: 'Cyber attacks on Scottish councils on rise: experts warn of dangers of IT legacy systems'
  • Scottish Government: 'Digital Infrastructure' report.